When 28.8 Million Queries Become a Weapon: A Technical Anatomy of the Distillation Offense and Defense
On June 24, 2026, Anthropic wrote to the U.S. Senate Banking Committee and White House officials accusing Alibaba‑linked operators of mounting a large‑scale distillation campaign against Claude using roughly 25,000 accounts. Over 45 days there were more than 28.8 million interactions, specifically targeting high‑value capabilities in software engineering and agentic reasoning. This allegation follows Anthropic's earlier accusations this year against three other Chinese LLM firms. The claim awaits responses from involved parties, but it has already sparked deeper debate.
More dramatically, an open‑source model that appeared on Hugging Face a week earlier, Qwable‑v1, provided a publicly inspectable technical specimen for this controversy. Released by an independent developer and built on the Qwen‑series MoE architecture, the model used chained distillation to inject Claude‑like reasoning chains and agentic tool‑use capabilities. It completed training with about 4,600 SFT examples, a single H200 GPU and roughly 14 hours of training. It transparently demonstrated the efficiency limits of distillation techniques.
How Distillation Works
Knowledge distillation, first popularized by Geoffrey Hinton in 2015, transfers knowledge from a larger "teacher" model to a smaller "student" model so the student retains high performance while reducing compute and deployment costs.
The basic process includes:
- The teacher generates high‑quality outputs (including reasoning chains and probability distributions).
- The student imitates via supervised fine‑tuning (SFT) or reinforcement learning.
- Advanced variants include chain‑of‑thought distillation (used by Qwable‑v1), adversarial distillation, and others.
In the LLM domain, distillation is particularly effective at compressing trillion‑parameter models into efficient versions. Qwable‑v1 is a typical example: it migrated Claude's advanced reasoning and tool‑use behaviors onto an open‑source Qwen base, enabling rapid capability replication driven by the community.
The Technical Logic of a Distillation Attack
A distillation attack differs from traditional data theft. Its goal is not to obtain model weights but to systematically collect a teacher model's reasoning processes and tool‑use patterns for specific tasks via large‑scale, structured API calls, then train an in‑house model on those outputs. Attackers do not need to understand Claude's internals — they only need to make Claude "perform" enough times.
This campaign showed a high degree of organization. The roughly 25,000 accounts followed a focused query strategy centered on code generation, debugging, and multi‑step tool invocation scenarios. This task‑focused distillation maximizes the information density of each training example. Given that Claude can produce thousands of tokens of reasoning chains and multiple rounds of tool calls in a single agentic task, the structured knowledge embedded in 28.8 million interactions is sufficient to help a student model rapidly approach teacher‑level performance in specific domains.
Defense: An Asymmetric Cat‑and‑Mouse Game
Anthropic has deployed anti‑distillation classifiers; its Fable‑series models fall back to alternative models when suspected distillation queries are detected. Defense is not merely traffic filtering — attackers can already bypass basic rate limits — but involves analyzing "behavioral fingerprints" of queries. Distillation query distributions naturally differ from normal users: they concentrate on narrow task domains, the question structures become templated, and they deliberately prompt models to produce full reasoning chains. With sufficient samples, these features form detectable statistical signals.
Yet the game is inherently asymmetric. Large‑model APIs are designed to "show capability," and every legitimate query generates outputs that can be used for distillation. Anthropic cannot fully prevent output collection and reuse without degrading product value. The commercial model of selling intelligent API access inherently creates a channel for knowledge leakage. Attackers can inject noise or mimic normal usage to reduce detection risk at the cost of lower distillation efficiency; defenders must constantly balance false positives (hurting legitimate users) against false negatives (letting attackers through).
Limits of Distillation: What Can and Cannot Be Copied
Qwable‑v1 clearly marks the capability boundaries of distillation. At the "behavioral pattern" level — the format of reasoning chains, tool‑call structure, coding style preferences — distillation achieves very high replication efficiency. This explains why only ~4,600 examples were sufficient to see effects: these surface‑level patterns are relatively stable and can be captured with few samples.
But at deeper levels, distillation faces information bottlenecks. A teacher model's outputs are a "projection" of massive parameters and training data and remain a lossy compression. Internal world knowledge, handling of edge cases, and the "intuition" used in long‑range reasoning are hard to fully capture from finite output samples. Crucially, leading labs maintain an advantage through continuous iteration and closed‑loop feedback systems — each update incorporates alignment signals and safety feedback from vast user interactions. This dynamic evolution is difficult for static distillation to match unless an attacker can distill at the same frequency, which becomes exponentially more costly as defenses improve.
Moreover, chained distillation itself suffers information degradation. Qwable‑v1's two‑stage approach (first injecting reasoning capability, then layering tool‑use ability) is lossy at each step. Loss accumulates layer by layer, making the model performance unstable in open‑domain reasoning while remaining strong on structured tasks where the "correct behavior" patterns are relatively fixed.
A Structural Dilemma: When "Showing" Is "Leaking"
This incident points to a systemic issue: a large model's "intelligence" is a behavior pattern that can be observed and replicated through interaction, a fundamental break with traditional software IP protection. Traditional software code is hidden and users only see inputs and outputs; a large model's "code" — the reasoning strategies encoded in parameters — is partially revealed with each API call. You cannot sell intelligence without showing it.
Anthropic's decision to use political channels rather than solely legal ones signals that current IP frameworks may be ill‑equipped to handle model distillation. Qwable‑v1 released weights and its training dataset under AGPL‑3.0, exposing compliance disputes about training data sources to public scrutiny, but that license does not resolve upstream rights over Claude's outputs.
The 28.8 million queries have already occurred, and the technical bar for distillation has been shown to be low enough that an individual developer with one GPU can cross it. The question is no longer whether distillation can be stopped, but how AI competition will be reshaped when the cost of copying knowledge approaches zero, and whether innovators can still recoup their investments. This controversy, which began with a letter from San Francisco, may become a footnote in how the rules of the knowledge economy are defined in the AI era.
▶️ Enjoy this article? Creating content is hard!
Subscribe to our YouTube channel:
AI Rosetta
Your likes, subscriptions and shares are our greatest support! 🙏
For more AI news visit: https://www.airosetta.com